Skip to main content

​
Overview

The Cylance integration enables ThreatAware to access your Cylance Console data, providing visibility into endpoint protection status, threat detections, and security events. This helps you validate your endpoint security controls and monitor threat activity.
Connection Method: API Setup Time: 15 minutes Access Required: Cylance Administrator account

​
Data collected

The Cylance integration provides:
  • Endpoint protection status
  • Threat detection events
  • Device security posture
  • Protection policy information

​
Use cases

Threat Detection Monitoring

Monitor detected threats and malware across endpoints

Protection Status

Verify Cylance protection is active on all managed devices

Security Compliance

Validate endpoint protection requirements are met

Incident Response

Track threat events for security investigations

​
Setup instructions

1

Log in to ThreatAware

  • Navigate to the ThreatAware dashboard
  • Go to Settings → Integrations
  • Use the search bar to find Cylance
  • Click Connect - a pop-up window will appear
2

Access Cylance Console

  • Log in to the Cylance Console as an administrator
  • Navigate to the tenant you wish to connect to ThreatAware
3

Gather Tenant ID

  • In the Cylance Console, go to Settings > Integrations
  • Locate and copy the Tenant ID displayed in the top right corner
  • Keep this ID for the next step
4

Create API Application

  • In the Cylance Console, click Add Application
  • Name the application “ThreatAware”
  • Select Read for all permissions (read-only access required)
  • Click Save
  • Copy the Application ID and Application Secret that are displayed
  • Store these securely
5

Identify Zone ID

  • Navigate to the zone in Cylance Console you wish to connect
  • Copy the Zone ID from the URL
  • Note the Zone ID for configuration in ThreatAware
6

Configure in ThreatAware

In the ThreatAware pop-up window, enter:
  • Tenant ID: The Tenant ID from Cylance Settings
  • Application ID: The Application ID created for ThreatAware
  • Application Secret: The Application Secret from the API application
  • Zone ID: The Zone ID from the Cylance Console URL
  • Click Authorize to establish the connection
7

Verify Connection

  • Check that the integration status displays as Active
  • Data collection will begin within 1 hour
  • Verify Cylance data appears in ThreatAware

​
Required credentials

Field Name: Cylance Tenant ID Type: String Description: Your organisation’s Cylance tenant identifier
  • Found in Cylance Console under Settings > Integrations
  • Displayed in the top right corner
  • Required for API authentication
Field Name: Cylance Application ID Type: String Description: The unique identifier for the ThreatAware API application
  • Generated when creating the API application in Cylance
  • Required for API access
Field Name: Cylance Application Secret Type: Password (encrypted) Description: The secret credential for authenticating to the Cylance API
Store this credential securely in your organisation’s password manager. You will not be able to retrieve it later from Cylance Console.
Field Name: Cylance Zone ID Type: String Description: The identifier for the Cylance zone to monitor
  • Found in the Cylance Console URL when viewing a zone
  • You can connect multiple zones by creating separate integrations

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings → Integrations in ThreatAware
    • Confirm Cylance shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait 60 minutes for the initial data poll
    • Search for a known device in ThreatAware
    • Verify Cylance protection status appears in device details
  3. Test Threat Data
    • Create a test query to filter devices by Cylance threat detection
    • Verify detected threats match the Cylance Console

​
Troubleshooting

Symptoms: Integration status shows authentication failureSolutions:
  • Verify the Tenant ID, Application ID, and Application Secret are correct
  • Ensure credentials were copied completely without extra spaces
  • Check that the API application exists and is active in Cylance Console
  • Verify your administrator account still has access to the application
Symptoms: Integration connects but no data appears or access is deniedSolutions:
  • Verify the API application was created with Read permissions
  • Check that all permissions are set to “Read” (not restricted)
  • Ensure the API application has access to the specified Zone
  • Review Cylance Integration API Documentation for permission requirements
  • Contact Cylance support if permission issues persist
Symptoms: Integration fails to authenticate or connect to zoneSolutions:
  • Verify the Zone ID is copied correctly from the Cylance Console URL
  • Ensure the Zone ID format is correct
  • Verify your API application has access to the specified zone
  • Check that the zone is active and accessible
Symptoms: Integration shows active but no Cylance data appearsSolutions:
  • Verify there is device and threat data in Cylance to collect
  • Check the API application’s scope and permissions in Cylance
  • Confirm the Zone ID is correct and contains devices
  • Wait additional time - first sync may take longer
  • Contact ThreatAware support if data collection continues to fail

​
Important notes

Permission Verification
  • Ensure all API permissions are set to Read only
  • ThreatAware does not require write access to Cylance
  • Verify these permission settings match when creating or modifying the API application
Data Accuracy
  • Ensure all IDs (Tenant, Application, Zone) are copied accurately from Cylance Console
  • Double-check for leading or trailing spaces when copying credentials
  • Test the integration immediately after setup to catch any configuration issues

​
Additional resources

Cylance Integration API Documentation

Official Cylance API documentation for detailed setup and permissions

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

API Credential Security
  • Create a dedicated API application specifically for ThreatAware
  • Document the Zone IDs you have connected
  • Store credentials securely in your organisation’s password manager
  • Rotate Application Secrets annually or per your security policy
  • Monitor Cylance audit logs for API usage activity
Multi-Zone Management
  • For multiple zones, create separate ThreatAware integrations
  • Document which integration connects to which zone
  • Test each integration independently to ensure proper configuration
  • Consolidate zone monitoring in ThreatAware for centralized visibility